# CWE-116. Every Advisory and CVE whose sources give the weakness CWE-116, newest first. ## Records, newest first (an older page) - [Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter](https://agentprime.io/advisories/GHSA-4f78-qhmw-8j8m.md) `GHSA-4f78-qhmw-8j8m`, `CVE-2026-70609` · npm `electron`: affected `<39.8.7 || >=40.0.0-alpha.1, <40.9.0 || >=41.0.0-alpha.1, <41.2.0 || >=42.0.0-alpha.1, <42.0.0-beta.1`, fixed in `39.8.7`, `40.9.0`, `41.2.0`, `42.0.0-beta.1` · CVSS 5.7 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Code injection, CWE-116 - [CentreStack < 17.4 Session Injection via SelectProvider.aspx](https://agentprime.io/advisories/CVE-2026-54364.md) `CVE-2026-54364` · CVE record: Gladinet CentreStack · CVSS 6.9 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-116 - [mathlive's Lack of Escaping of HTML allows for XSS](https://agentprime.io/advisories/GHSA-fm7p-gw32-828p.md) `GHSA-fm7p-gw32-828p`, `CVE-2026-54705` · npm `mathlive`: affected `<0.110.0`, fixed in `0.110.0` · CVSS 6.3 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-116 - [Terminal Escape Injection in diff‑so‑fancy](https://agentprime.io/advisories/CVE-2026-50642.md) `CVE-2026-50642` · CVE record: so-fancy diff-so-fancy · CVSS 4.8 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-116 - [Shescape: Home-directory disclosure in assignment context on Unix with Dash](https://agentprime.io/advisories/GHSA-q53c-4prm-w95q.md) `GHSA-q53c-4prm-w95q`, `CVE-2026-73411` · npm `shescape`: affected `<2.1.14 || >=3.0.0, <3.0.1`, fixed in `2.1.14`, `3.0.1` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure, CWE-116 - [ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797](https://agentprime.io/advisories/GHSA-hc76-7mpc-qjqh.md) `GHSA-hc76-7mpc-qjqh` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.7 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802](https://agentprime.io/advisories/CVE-2026-55730.md) `CVE-2026-55730` · CVE record: Loytec LWEB-802 · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server](https://agentprime.io/advisories/CVE-2026-12496.md) `CVE-2026-12496` · CVE record: Loytec LIP-ME20xC and 4 more · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [JupyterLab: Cross-site scripting (XSS) via crafted settings file (\`overrides.json\`)](https://agentprime.io/advisories/GHSA-pppj-hq3g-57pj.md) `GHSA-pppj-hq3g-57pj`, `BIT-jupyterlab-2026-73417`, `CVE-2026-73417`, `PYSEC-2026-3672` · PyPI `jupyterlab`: affected `>=3.3.0, <4.5.10 || >=4.6.0, <4.6.2`, fixed in `4.5.10`, `4.6.2` · CVSS 8.6 High · Not analysed yet · Published 22 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences](https://agentprime.io/advisories/GHSA-4633-3j49-mh5q.md) `GHSA-4633-3j49-mh5q`, `CVE-2026-64647` · npm `next`: affected `>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11`, fixed in `15.5.21`, `16.2.11` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-116 - [Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility](https://agentprime.io/advisories/GHSA-w62v-xxxg-mg59.md) `GHSA-w62v-xxxg-mg59`, `CVE-2026-59895` · npm `hono`: affected `>=4.0.0, <4.12.27`, fixed in `4.12.27` · CVSS 6.1 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Astro: Cross-site scripting via unescaped transition:\* directive values on hydrated islands](https://agentprime.io/advisories/GHSA-7pw4-f3q4-r2p2.md) `GHSA-7pw4-f3q4-r2p2`, `CVE-2026-59727` · npm `astro`: affected `>=3.10.0, <7.0.4`, fixed in `7.0.4` · CVSS 2.1 Low · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability](https://agentprime.io/advisories/GHSA-74jp-vm22-8q8x.md) `GHSA-74jp-vm22-8q8x`, `BIT-dotnet-2026-50659`, `BIT-dotnet-sdk-2026-50659`, `CVE-2026-50659` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 6.5 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-116 - [An issue was discovered in openRISC OR1200 commit 83ac6b.](https://agentprime.io/advisories/CVE-2025-51677.md) `CVE-2025-51677` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-116 - [Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema](https://agentprime.io/advisories/GHSA-w757-xvvv-vgfw.md) `GHSA-w757-xvvv-vgfw`, `CVE-2026-63397` · npm `@genql/cli`: affected `<6.3.4`, fixed in `6.3.4` · CVSS 7.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-116 - [Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env](https://agentprime.io/advisories/CVE-2026-15809.md) `CVE-2026-15809` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.12 and 4 more · CVSS 7.8 High · Not analysed yet · Published 15 Jul 2026 · Tags: Memory corruption, CWE-116 - [Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)](https://agentprime.io/advisories/CVE-2026-48358.md) `CVE-2026-48358` · CVE record: Adobe Adobe Commerce and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-116 - [FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of \`Tools::noHtml\`-escaped quotes inside \`onclick=\`](https://agentprime.io/advisories/GHSA-3x7p-v8hj-xh5m.md) `GHSA-3x7p-v8hj-xh5m`, `CVE-2026-45710`, `PKSA-tj9x-5rgg-xzgk` · Packagist `facturascripts/facturascripts`: affected `<2026.2`, fixed in `2026.2` · CVSS 3.5 Low · Not analysed yet · Published 14 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [HedgeDoc: Stored HTML injection via email local-part](https://agentprime.io/advisories/CVE-2026-58487.md) `CVE-2026-58487` · CVE record: hedgedoc hedgedoc · CVSS 5.1 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [luci-app-banip Log Monitor IP Extraction Bypass](https://agentprime.io/advisories/CVE-2026-62184.md) `CVE-2026-62184` · CVE record: openwrt luci-app-banip · CVSS 8.7 High · Not analysed yet · Published 13 Jul 2026 · Tags: CWE-116 - [Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization](https://agentprime.io/advisories/GHSA-qv9r-c865-cp47.md) `GHSA-qv9r-c865-cp47`, `CVE-2026-49844` · Maven `org.apache.logging.log4j:log4j-api`: affected `>=2.13.1, <2.25.5 || >=2.26.0, <2.26.1`, fixed in `2.25.5`, `2.26.1` · CVSS 6.3 Medium · Not analysed yet · Published 11 Jul 2026 · Tags: CWE-116 - [Grist: XSS through unsafe value interpolation in server-rendered pages](https://agentprime.io/advisories/CVE-2026-55659.md) `CVE-2026-55659` · CVE record: gristlabs grist-core · CVSS 7.7 High · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)](https://agentprime.io/advisories/CVE-2026-59833.md) `CVE-2026-59833` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116 - [YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))](https://agentprime.io/advisories/GHSA-xc7j-3g8q-9vh4.md) `GHSA-xc7j-3g8q-9vh4`, `CVE-2026-52772`, `PKSA-p24r-4kjm-tm2m` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 5.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path](https://agentprime.io/advisories/GHSA-cwv4-h3j5-w3cf.md) `GHSA-cwv4-h3j5-w3cf` · crates.io `rama`: affected `<0.3.0-rc.1`, fixed in `0.3.0-rc.1` · CVSS 3.7 Low · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-116 - [printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)](https://agentprime.io/advisories/GHSA-p7h3-7q52-72w8.md) `GHSA-p7h3-7q52-72w8`, `CVE-2026-35366` · crates.io `uu_printenv`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.4 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-116, CWE-754 - [comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output](https://agentprime.io/advisories/GHSA-6gcw-w7cp-94g9.md) `GHSA-6gcw-w7cp-94g9`, `CVE-2026-35346` · crates.io `uu_comm`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 3.3 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-116, CWE-176 - [Improper Output Neutralization for Logs in Kibana Leading to Log Injection](https://agentprime.io/advisories/CVE-2026-49091.md) `CVE-2026-49091` · CVE record: Elastic Kibana · CVSS 8.0 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-116 - [Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer](https://agentprime.io/advisories/CVE-2026-47206.md) `CVE-2026-47206` · CVE record: dragonflydb dragonfly · CVSS 2.3 Low · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-116 - [Improper output encoding in Apple swift-nio-http2](https://agentprime.io/advisories/CVE-2026-28898.md) `CVE-2026-28898` · CVE record: Apple swift-nio-http2 · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-116 - [justhtml: to_markdown() code-span blank-line breakout enables XSS](https://agentprime.io/advisories/GHSA-jf6w-2mvx-633j.md) `GHSA-jf6w-2mvx-633j`, `CVE-2026-77088` · PyPI `justhtml`: affected `>=0.9.0, <1.22.0`, fixed in `1.22.0` · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Prometheus denial of service via crafted DNS queries](https://agentprime.io/advisories/CVE-2026-40011.md) `CVE-2026-40011` · CVE record: PowerDNS DNSdist · CVSS 3.7 Low · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-116 - [SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped \`data-obj\` attribute (Bypass for CVE-2026-45375's patch)](https://agentprime.io/advisories/CVE-2026-55570.md) `CVE-2026-55570` · CVE record: siyuan-note siyuan · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116 - [Warp: OS command injection when opening terminal links from WSL](https://agentprime.io/advisories/CVE-2026-54699.md) `CVE-2026-54699` · CVE record: warpdotdev warp · CVSS 7.7 High · Not analysed yet · Published 24 Jun 2026 · Tags: Command injection, CWE-116 - [Duplicate Advisory: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c](https://agentprime.io/advisories/GHSA-v772-658q-978p.md) `GHSA-v772-658q-978p` · NuGet `Magick.NET-Q16-AnyCPU`: affected `<14.10.3`, fixed in `14.10.3` · CVSS 0.0 None · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Command injection, CWE-116 - [Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL](https://agentprime.io/advisories/GHSA-chxj-gxww-q98w.md) `GHSA-chxj-gxww-q98w`, `BIT-nifi-2026-44913`, `CVE-2026-44913` · Maven `org.apache.nifi:nifi-cdc-mysql-processors`: affected `>=1.2.0, <2.10.0`, fixed in `2.10.0` · CVSS 5.2 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-116 - [OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source](https://agentprime.io/advisories/GHSA-9wxg-vf3r-56hc.md) `GHSA-9wxg-vf3r-56hc`, `CVE-2026-57583` · npm `@openzeppelin/wizard` and 3 more: affected `<0.10.11`, fixed in `0.10.11` · CVSS 3.3 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Code injection, CWE-116 - [pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser](https://agentprime.io/advisories/CVE-2026-12048.md) `CVE-2026-12048` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text](https://agentprime.io/advisories/CVE-2026-12047.md) `CVE-2026-12047` · CVE record: pgadmin.org pgAdmin 4 · CVSS 4.8 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [pgAdmin 4: SQL injection in COMMENT ON ... IS '\' rendering across dialog templates](https://agentprime.io/advisories/CVE-2026-12044.md) `CVE-2026-12044` · CVE record: pgadmin.org pgAdmin 4 · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection, CWE-116 - [Heimdall: IP Spoofing via Unvalidated Forwarding Headers](https://agentprime.io/advisories/GHSA-38x9-25wx-7fg2.md) `GHSA-38x9-25wx-7fg2`, `CVE-2026-57210`, `GO-2026-5075` · Go `https://github.com/dadrus/heimdall`: affected `<0.17.17`, fixed in `0.17.17` · CVSS 7.0 High · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, CWE-20, CWE-116 - [Open WebUI: Stored XSS to Account Takeover via Model Profile Images](https://agentprime.io/advisories/GHSA-v2qm-5wxj-qhj7.md) `GHSA-v2qm-5wxj-qhj7`, `CVE-2026-54013`, `PYSEC-2026-2757` · PyPI `open-webui`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 7.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-693 - [Laravel Framework: Temporary Signed URL Path Confusion](https://agentprime.io/advisories/GHSA-crmm-hgp2-wgrp.md) `GHSA-crmm-hgp2-wgrp`, `PKSA-m5cs-t1y6-qpcs` · Packagist `laravel/framework`: affected `<12.61.1 || >=13.0.0, <13.12.0`, fixed in `12.61.1`, `13.12.0` · CVSS 4.2 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-116 - [Caddy: stripHTML template function bypass](https://agentprime.io/advisories/GHSA-vcc4-2c75-vc9v.md) `GHSA-vcc4-2c75-vc9v`, `CVE-2026-52846`, `GO-2026-5660` · Go `github.com/caddyserver/caddy` and 1 more: affected `<=1.0.5`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-116 - [hono: AWS Lambda adapter merges multiple \`Set-Cookie\` headers into one value, dropping cookies on ALB single-header and Lattice](https://agentprime.io/advisories/GHSA-j6c9-x7qj-28xf.md) `GHSA-j6c9-x7qj-28xf`, `CVE-2026-54287` · npm `hono`: affected `<4.12.25`, fixed in `4.12.25` · CVSS 5.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-116 - [Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization](https://agentprime.io/advisories/GHSA-w22m-hvvm-xmwx.md) `GHSA-w22m-hvvm-xmwx`, `CVE-2026-44311` · npm `fabric`: affected `<7.4.0`, fixed in `7.4.0` · CVSS 5.4 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)](https://agentprime.io/advisories/GHSA-6jq6-x4cx-qvcm.md) `GHSA-6jq6-x4cx-qvcm`, `PKSA-197r-m2ry-57db` · Packagist `grumpydictator/firefly-iii`: affected `<6.6.3`, fixed in `6.6.3` · CVSS 4.0, no score published · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through \`/warns\`.](https://agentprime.io/advisories/CVE-2026-48485.md) `CVE-2026-48485` · CVE record: duck-organization questbot · CVSS 2.1 Low · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-116 - [Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.](https://agentprime.io/advisories/CVE-2026-47188.md) `CVE-2026-47188` · CVE record: duck-organization quest-bot · CVSS 2.3 Low · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-116 - [Quest Bot: Moderation reason fields allow bot-powered \`@everyone\` / \`@here\` pings](https://agentprime.io/advisories/CVE-2026-47175.md) `CVE-2026-47175` · CVE record: duck-organization quest-bot · CVSS 2.3 Low · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-116 - [Quest Bot: Ticket reason allows mass-mention injection](https://agentprime.io/advisories/CVE-2026-47173.md) `CVE-2026-47173` · CVE record: duck-organization quest-bot · CVSS 6.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-116 - [Quest Bot: Reminder messages allow stored mass mentions through \`@everyone\` and \`@here\`](https://agentprime.io/advisories/CVE-2026-47171.md) `CVE-2026-47171` · CVE record: duck-organization quest-bot · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-116 - [nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)](https://agentprime.io/advisories/GHSA-9pg3-25fq-p6cc.md) `GHSA-9pg3-25fq-p6cc`, `CVE-2026-47768`, `GO-2026-5294` · Go `github.com/juev/nebula-mesh`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 5.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Information disclosure, CWE-116, CWE-598 - [Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet](https://agentprime.io/advisories/CVE-2026-42558.md) `CVE-2026-42558` · CVE record: xibosignage xibo-cms · CVSS 7.6 High · Not analysed yet · Published 10 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-346 - [MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels](https://agentprime.io/advisories/CVE-2026-53693.md) `CVE-2026-53693` · CVE record: misp bsimvis · CVSS 6.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat](https://agentprime.io/advisories/CVE-2026-49472.md) `CVE-2026-49472` · CVE record: signalwire freeswitch · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-116 - [Injection in Rapid7 Velociraptor](https://agentprime.io/advisories/CVE-2026-8795.md) `CVE-2026-8795` · CVE record: Rapid7 Velociraptor · CVSS 7.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Other injection, Code injection, CWE-116 - [Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-20245.md) `CVE-2026-20245` · CVE record: Cisco Cisco Catalyst SD-WAN Controller and 1 more · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.25 · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-116 - [GLPI has stored XSS in asset locks](https://agentprime.io/advisories/CVE-2026-42321.md) `CVE-2026-42321` · CVE record: glpi-project glpi · CVSS 8.4 High · Not analysed yet · Published 3 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection](https://agentprime.io/advisories/GHSA-28jh-g32x-v9v4.md) `GHSA-28jh-g32x-v9v4`, `CVE-2026-48598`, `EEF-CVE-2026-48598` · Hex `tesla`: affected `>=0.8.0, <1.18.3`, fixed in `1.18.3` · CVSS 2.1 Low · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-116 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .